nemoclaw-maintainer-runtime-provider

Register one RuntimeProviderBundle under a single opaque provider ID covering all 14 surfaces, with optional surfaces declaring supported: false and a reason. Persist the provider ID in SandboxEntry.openshellDriver so every lifecycle operation resolves the same bundle.

Activation requires a RuntimeProviderActivationRegistration composed through createCurrentRuntimeProviderBundles, backed by protected GitHub Actions qualification evidence bound to the commit, workflow run, and artifact digests. Adding a provider directly to the established registry is not allowed.

The bundle contains 14 surfaces including plan, capabilities, preflightDoctor, gateway, workload, hostLocalInference, lifecycle, mutationAuthority, stateMutation, bootstrap, snapshot, recovery, cleanup, and containerEngine. Candidates may mark optional surfaces unsupported with a reason; activation requires all 14 supported.

No. Generic onboarding, lifecycle, and cleanup modules must consume bundle surfaces and must not import provider implementations or compare provider-name literals. Missing behavior requires a narrow contract extension through an accepted design decision.

Do not use it for the portable experimental profile, which is a separate product path with independent selection and compatibility behavior. It also does not apply when a provider topology cannot meet the activation contract without an accepted contract extension.